https://vulnogram.org/ Most recent CVEs assigned by Moxa Inc. (moxa). https://vulnogram.org/seaview/icons/moxa.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-109813 https://vulnogram.org/CVE-2026-109813 A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the co… High Fri, 16 Oct 2026 02:57:52 GMT https://vulnogram.org/CVE-2026-109812 https://vulnogram.org/CVE-2026-109812 A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensi… Medium Fri, 16 Oct 2026 02:54:46 GMT https://vulnogram.org/CVE-2026-86326 https://vulnogram.org/CVE-2026-86326 An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and acce… High Fri, 02 Oct 2026 10:21:56 GMT https://vulnogram.org/CVE-2026-86325 https://vulnogram.org/CVE-2026-86325 A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attac… Critical Fri, 02 Oct 2026 10:18:29 GMT https://vulnogram.org/CVE-2026-15579 https://vulnogram.org/CVE-2026-15579 An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly long input, tr… High Network Exploitable Fri, 18 Sep 2026 09:32:59 GMT https://vulnogram.org/CVE-2026-10831 https://vulnogram.org/CVE-2026-10831 A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly validate whether a sender is associated with a valid data port session before accepting break si… Medium Network Exploitable Tue, 16 Jun 2026 13:46:27 GMT https://vulnogram.org/CVE-2026-10829 https://vulnogram.org/CVE-2026-10829 A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. This vulnerability stems from insufficient input validation of user-supplied input in the "Server location" parameter on the B… High Tue, 16 Jun 2026 10:18:41 GMT https://vulnogram.org/CVE-2026-10828 https://vulnogram.org/CVE-2026-10828 A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and prior. This vulnerability stems from insufficient input validation and improper handl… Medium Tue, 16 Jun 2026 10:16:12 GMT https://vulnogram.org/CVE-2026-10825 https://vulnogram.org/CVE-2026-10825 A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption and may resu… High Tue, 16 Jun 2026 08:51:57 GMT https://vulnogram.org/CVE-2026-9266 https://vulnogram.org/CVE-2026-9266 A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers and controllers. This vulnerability represents an incomplete remediation of CVE-2026-0714. The firmware introduced TPM2… High Fri, 12 Jun 2026 10:00:33 GMT https://vulnogram.org/CVE-2026-3868 https://vulnogram.org/CVE-2026-3868 An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. Because of improper validation of length parameters in the HTTPS management interface, an unauthenticated remote attacker could send… High Network Exploitable Mon, 27 Apr 2026 02:56:34 GMT https://vulnogram.org/CVE-2026-3867 https://vulnogram.org/CVE-2026-3867 An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged authenticated user may access a configuration file containing the hashed password of the administra… Medium Mon, 27 Apr 2026 02:54:00 GMT https://vulnogram.org/CVE-2026-4483 https://vulnogram.org/CVE-2026-4483 An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The affected utility, MxGeneralIo, exposes IOCTL methods that permit direct read and write access… High Wed, 08 Apr 2026 07:25:03 GMT https://vulnogram.org/CVE-2026-0715 https://vulnogram.org/CVE-2026-0715 Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a ser… High Thu, 05 Feb 2026 17:01:20 GMT https://vulnogram.org/CVE-2026-0714 https://vulnogram.org/CVE-2026-0714 A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Linux 3, where the discrete TPM is connected to the CPU via an SPI bus. Exploitation requires invasive physical… High Thu, 05 Feb 2026 16:58:50 GMT https://vulnogram.org/CVE-2025-15017 https://vulnogram.org/CVE-2025-15017 A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface and, without authentication, user interaction, or… High Wed, 31 Dec 2025 07:44:24 GMT https://vulnogram.org/CVE-2025-2026 https://vulnogram.org/CVE-2025-2026 The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection through the device’s web API. This may lead to an unexpected device reboot and result in a den… High Wed, 31 Dec 2025 07:32:26 GMT https://vulnogram.org/CVE-2025-1977 https://vulnogram.org/CVE-2025-1977 The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authenticated user with read-only access to perform unauthorized configuration changes through the MCC (Moxa CLI Con… High Wed, 31 Dec 2025 07:23:28 GMT https://vulnogram.org/CVE-2025-9315 https://vulnogram.org/CVE-2025-9315 An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identified in the MXsecurity Series. An unauthenticated remote attacker can exploit this vulnerab… Medium Network Exploitable Wed, 10 Dec 2025 08:31:08 GMT https://vulnogram.org/CVE-2025-1680 https://vulnogram.org/CVE-2025-1680 An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Host headers by injecting a specially crafted Host he… Thu, 23 Oct 2025 13:56:39 GMT https://vulnogram.org/CVE-2025-1679 https://vulnogram.org/CVE-2025-1679 Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s web service that could impact authenticated users interacting with the dev… Medium Thu, 23 Oct 2025 13:51:27 GMT https://vulnogram.org/CVE-2025-6950 https://vulnogram.org/CVE-2025-6950 An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret key to sign JSON Web Tokens (JWT) used for authentication. This insecure implementation allow… Critical Network Exploitable Fri, 17 Oct 2025 03:19:48 GMT https://vulnogram.org/CVE-2025-6949 https://vulnogram.org/CVE-2025-6949 An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A critical authorization flaw in the API allows an authenticated, low-privileged user to create a new administrator account,… Critical Fri, 17 Oct 2025 03:12:02 GMT https://vulnogram.org/CVE-2025-6894 https://vulnogram.org/CVE-2025-6894 An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authorization logic of the affected device allows an authenticated, low-privileged user to execute the adm… Medium Fri, 17 Oct 2025 02:25:15 GMT https://vulnogram.org/CVE-2025-6893 https://vulnogram.org/CVE-2025-6893 An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in broken access control has been identified in the /api/v1/setting/data endpoint of the affected device. This flaw a… Critical Fri, 17 Oct 2025 02:17:07 GMT https://vulnogram.org/CVE-2025-6892 https://vulnogram.org/CVE-2025-6892 An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentication mechanism allows unauthorized access to protected API endpoints, including those intended for administrat… High Network Exploitable Fri, 17 Oct 2025 02:07:25 GMT https://vulnogram.org/CVE-2025-5191 https://vulnogram.org/CVE-2025-5191 An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows). Due to the unquoted path configuration in the SerialInterfaceService.exe utility, a local attacker with limited privileges could place… High Mon, 25 Aug 2025 08:01:11 GMT https://vulnogram.org/CVE-2025-0676 https://vulnogram.org/CVE-2025-0676 This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input validation to inject and execute systems commands. Successful exploitation could result in… High Wed, 02 Apr 2025 06:32:27 GMT https://vulnogram.org/CVE-2025-0415 https://vulnogram.org/CVE-2025-0415 A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a… Critical Wed, 02 Apr 2025 06:22:11 GMT https://vulnogram.org/CVE-2024-7695 https://vulnogram.org/CVE-2024-7695 Multiple switches are affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which allows data to be written to memory outside the bounds of the buffer. Successful exploitation of this vulnera… High Network Exploitable Wed, 29 Jan 2025 07:42:54 GMT https://vulnogram.org/CVE-2025-0193 https://vulnogram.org/CVE-2025-0193 A stored Cross-site Scripting (XSS) vulnerability exists in the MGate 5121/5122/5123 Series firmware version v1.0 because of insufficient sanitization and encoding of user input in the "Login Message" functionality. An authenticated attacker with adm… Medium Wed, 15 Jan 2025 11:05:11 GMT https://vulnogram.org/CVE-2024-12297 https://vulnogram.org/CVE-2024-12297 Moxa’s Ethernet switch is vulnerable to an authentication bypass because of flaws in its authorization mechanism. Although both client-side and back-end server verification are involved in the process, attackers can exploit weaknesses in its implemen… Critical Network Exploitable Wed, 15 Jan 2025 10:00:46 GMT https://vulnogram.org/CVE-2024-9140 https://vulnogram.org/CVE-2024-9140 Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140. This vulnerability allows OS command injection due to improperly restricted commands, potentially enabling attackers to… Critical Network Exploitable Fri, 03 Jan 2025 08:26:18 GMT https://vulnogram.org/CVE-2024-9138 https://vulnogram.org/CVE-2024-9138 Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain… High Fri, 03 Jan 2025 08:14:31 GMT https://vulnogram.org/CVE-2024-9404 https://vulnogram.org/CVE-2024-9404 This vulnerability could lead to denial-of-service or service crashes. Exploitation of the moxa_cmd service, because of insufficient input validation, allows attackers to disrupt operations. If exposed to public networks, the vulnerability poses a si… High Network Exploitable Wed, 04 Dec 2024 03:54:32 GMT https://vulnogram.org/CVE-2024-4740 https://vulnogram.org/CVE-2024-4740 MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials. This vulnerability could allow an attacker to tamper with sensitive data. Medium Network Exploitable Fri, 18 Oct 2024 08:21:15 GMT https://vulnogram.org/CVE-2024-4739 https://vulnogram.org/CVE-2024-4739 The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authenticator, an attacker can pose as an authorized user and successfully access the resource. Medium Network Exploitable Fri, 18 Oct 2024 08:11:04 GMT https://vulnogram.org/CVE-2024-9139 https://vulnogram.org/CVE-2024-9139 The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code. High Mon, 14 Oct 2024 08:20:52 GMT https://vulnogram.org/CVE-2024-9137 https://vulnogram.org/CVE-2024-9137 The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuratio… Critical Network Exploitable Mon, 14 Oct 2024 08:09:22 GMT https://vulnogram.org/CVE-2024-6787 https://vulnogram.org/CVE-2024-6787 This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By exploiting this race condition, an attacker can write arbitrary files to the system. This could allow the att… Medium Sat, 21 Sep 2024 04:20:22 GMT https://vulnogram.org/CVE-2024-6786 https://vulnogram.org/CVE-2024-6786 The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary files on the system. This could lead to the disclosure of sensitive information, such as configuration files a… Medium Sat, 21 Sep 2024 04:14:22 GMT https://vulnogram.org/CVE-2024-6785 https://vulnogram.org/CVE-2024-6785 The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting in the service being abused due to sensitive information exposure. Medium Sat, 21 Sep 2024 04:07:27 GMT https://vulnogram.org/CVE-2024-4641 https://vulnogram.org/CVE-2024-4641 OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to cause a memory… Medium Tue, 25 Jun 2024 09:23:30 GMT https://vulnogram.org/CVE-2024-4640 https://vulnogram.org/CVE-2024-4640 OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to missing bounds checking on buffer operations. An attacker could write past the boundaries of allocated buffer regions in memory, causing a program c… High Tue, 25 Jun 2024 09:19:08 GMT https://vulnogram.org/CVE-2024-4639 https://vulnogram.org/CVE-2024-4639 OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An attacker could modify the intended commands sent to target functions, which could cause mali… High Tue, 25 Jun 2024 09:15:03 GMT https://vulnogram.org/CVE-2024-4638 https://vulnogram.org/CVE-2024-4638 OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload function. An attacker could modify the intended commands sent to target functions, which could ca… High Tue, 25 Jun 2024 08:49:24 GMT https://vulnogram.org/CVE-2024-3576 https://vulnogram.org/CVE-2024-3576 The NPort 5100A Series firmware version v1.6 and prior versions are affected by web server XSS vulnerability. The vulnerability is caused by not correctly neutralizing user-controllable input before placing it in output. Malicious users may use the v… High Network Exploitable Mon, 06 May 2024 12:04:47 GMT https://vulnogram.org/CVE-2024-1220 https://vulnogram.org/CVE-2024-1220 A stack-based buffer overflow in the built-in web server in Moxa NPort W2150A/W2250A Series firmware version 2.3 and prior allows a remote attacker to exploit the vulnerability by sending crafted payload to the web service. Successful exploitation of… High Network Exploitable Wed, 06 Mar 2024 01:51:19 GMT https://vulnogram.org/CVE-2024-0387 https://vulnogram.org/CVE-2024-0387 The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hi… Medium Mon, 26 Feb 2024 13:26:56 GMT https://vulnogram.org/CVE-2023-6094 https://vulnogram.org/CVE-2023-6094 A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensitive information during transmission. An attacker eavesdropping on the traffic between the we… Medium Network Exploitable Sun, 31 Dec 2023 09:57:27 GMT